Axelar (AXL)

Axelar network "Security incident, caused by third‑party token contract unlimited issuance vulnerability"

https://t.co/yuqlijzjC6 https://t.co/WDeRkWgewK

The only utility we got from these privacy protocols is giving access to exploiters to bridge illicit funds without knowing the destination of those funds (in almost most cases) 😭😂

So in short, we built privacy tek for exploiters not for real users. Just take a look at the Aztec protocol exploit, Zcash vulnerability, Zama contract seizing by circle because of illicit actor funds and now this Axelar case

The Secret post-mortem is out. The real story: the people who modified that bridge didn't understand how its own authentication worked. No outside auditor was ever asked to check it. And for three years, no attacker understood it either. The bridge held until (my bet) an AI finally read the contract and saw what every human had missed.

The miss is almost dumb in hindsight. The contract started as an escrow bridge, a coat check: it only ever hands back a coat someone checked in earlier, so "is this deposit real?" was answered for free by the ticket logic.

Then it was forked to mint Axelar tokens instead. Minted tokens were never checked in, so the ticket logic didn't fit and got deleted. Whoever did that didn't realize those exact functions were the only thing verifying which chain a deposit came from. The Allow List that replaced them checked which token could be minted, never its source.

So the door was open from January 2023. Then someone spun up a fake chain, named a real asset like USDT, and minted $4.67M out of nothing.

The lesson isn't really about Secret. For three years, finding this took a human willing to read the whole contract, and nobody did. That barrier is gone. An AI reads all of it, closely, for cents. So if your contract is public and hasn't been through an AI audit, assume the attacker's AI is already reading it. Audit yours first.